CVE-2026-33626 Scanner
CVE-2026-33626 Scanner - Server-Side Request Forgery (SSRF) vulnerability in LMDeploy
Used 3.5k times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-33626
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
lmdeploy
Updated Oct 24, 2026View on NVD →
S4E scanner
CVE history: lmdeploy
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →